Microsoft warns of data loss from Windows scripting flaw
Microsoft is warning that a scripting flaw affecting all versions of Windows could result in “unintended information disclosure.”
The flaw, which lies in the MHTML protocol handler and affects the way Internet Explorer handles web pages and documents, could enable hackers to steal private information or hijack computers, according to the security advisory. Users could inadvertently download malware by clicking on a web link.
Angela Gunn, an analyst with Microsoft’s Trustworthy Computing, explains the result of the flaw this way: “an attacker could construct an HTML link designed to trigger a malicious script and somehow convince the targeted user to click it. When the user clicked that link, the malicious script would run on the user's computer for the rest of the current Internet Explorer session. Such a script might collect user information (e.g., email), spoof content displayed in the browser, or otherwise interfere with the user's experience.”
